[ Ransomware claim · lockbit5 · 23 Oct 2026 ]
dorsiacademy.it
The ransomware group lockbit5 named dorsiacademy.it (Italy) on its leak site on 23 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
We have found no statement from dorsiacademy.it and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.
[ The organisation ]Who is dorsiacademy.it?
- What it does
- Dorsi Academy (Art School) is a vocational training provider accredited by the Lombardy region, part of the Dorsi group. It runs hairdressing, beauty and sales courses for young people after middle school, as well as adult courses, higher technical training (IFTS) and short courses. It also offers job services such as free training courses, company internships, self-employment support and job matching.
- Based in
- Varese, Lombardy, Italy, with a second site in Faloppio (Como)
- Size
- about 350 students when its Varese site was inaugurated in 2013
- Who it serves
- Teenagers leaving middle school who want to train as hairdressers, beauticians or sales staff, adults seeking training or work, and local businesses that take on trainees.
Partners and customers it names publicly
- Regione Lombardia, Accrediting body for vocational training
- Gruppo Dorsi, Parent group
[ Impact ]Who could be affected
Students, many of them minors, and their families could have personal, contact or school records exposed if the claim is genuine, which could lead to phishing or identity fraud. Lessons, enrolments, internships and job-placement services could be disrupted if systems are affected. Companies that host interns could also receive fraudulent messages that appear to come from the school.
In education generally: Pupils, students, parents and staff can lose access to lessons, exams and systems, and schools hold personal data about children and families.
[ The attacker ]About lockbit5
LockBit returned in September 2025 with LockBit 5.0, a ransomware-as-a-service operation with encryptors for Windows, Linux and VMware ESXi. Affiliates steal data before encrypting and give victims a deadline before publishing it.
lockbit5 has claimed 24 organisations in the last 30 days, most in United States, Thailand and Mexico, and mostly in other, professional services and financial services.
Other organisations lockbit5 has named
- Brazil
- Indonesia
- Thailand
- Mexico
- Lebanon
[ What to do ]If you are a customer, partner or neighbour
- Students and parents should be cautious with unexpected emails, messages or calls about enrolment, fees or certificates, and check them with the school directly.
- Change passwords for any school portal or account, especially if the same password is used elsewhere.
- Companies hosting interns should confirm any request for payment or personal data with a known contact at the school.
- Watch for a notice from the school explaining what happened and whether personal data was involved.